mikronova/modgunn

Móðguðr — the nordisk security / SCIP world-delta scanner (3rd repo proposal)

Roadmap design. Driver: holger/.nornir/holger-demo-plan.md (Tools menu #3). Umbrella: holger/.nornir/holger-evolution.md. Workspace decision stub: workspace_nordisk/PLAN.md.

Why a 3rd repo

Holger needs security verdicts; nornir owns the security plane (nornir/src/security.rs) and the SCIP/knowledge/warehouse machinery. Having holger depend on nornir (and nornir embed holger) would create a dependency cycle. So the scanner moves to its own leaf repo both consume:

        Móðguðr  (security + SCIP world-delta engine, leaf)
        /      \
   holger      nornir        ← both depend on Móðguðr; no cycle

Name: Móðguðr (Modgud) — CONFIRMED (Rickard, 2026-06-28). The giantess who guards Gjallarbrú, the bridge over the river Gjöll on the road to Hel; she challenges everyone who tries to cross and demands to know who they are. A gatekeeper that scrutinizes what passes — exactly the role. (Female, on-myth.)

Two engines, one repo

The user wants both, and they are genuinely different concerns:

Engine A — artifact security verdict (the "scan")

• CVE / license / provenance scan over an artifact or a whole znippy generation.
• Extract + generalize nornir's existing src/security.rs (scan / components / query_vulns / to_cyclonedx, cargo-only today) into Móðguðr; make it multi-ecosystem (the whole point of an artifact server that serves Maven/PyPI/npm/… ).

• Emits a cached verdict keyed by (blob_sha256, policy_version, advisory_db_rev) → block|warn|pass

  • CycloneDX SBOM. This is the verdict holger's policy gate / promotion gate and static-holger quarantine consume.

Engine B — SCIP whole-world dep-tree behavior-delta tracking (government-grade)

• Take in the whole world (or a sub-part of a product's deps) and keep delta track of EVERY single change in the code tree, to the smallest bit — including deep transitive behavior change: "a 5th-level dependency jar that hasn't changed in years suddenly changed behavior."
• Built on nornir's SCIP / knowledge / call-graph / arch-wiring machinery, lifted to Móðguðr.
• Multiple tripwires + graph algorithms + anomaly detection — not just a diff: behavior fingerprints, call-graph deltas, provenance/timeline anomalies, dependency-confusion / typosquat / maintainer-change signals, statistical outliers over the historized world.
• Resource posture: government site, knows exactly what happens to the smallest bit — designed to use 128 GB – 1 TB RAM when running a full-world delta. Heavy by design; lives in the dynamic plane only.

Static-holger angle (keep static dumb-but-safe)

• The scanner is NOT compiled into static-holger (no egress, no heavy engine).
• Static's only security action: validate a new znippy, then switch to it — i.e. consume a verdict produced by Móðguðr/dynamic, and atomically swap the served archive to a validated one. Quarantine = swap to a validated generation. No scanning, no filtering logic inside static.

Consumers

• holger (dynamic): Tools menu #3 "Security scan"; policy gate before serve/promote; the verdict that static later switches on.
• nornir: the viz security pane, warehouse historization (sbom_components/vuln_findings), and the world-delta tripwire feed.

Storage decision (2026-06-29, owner-confirmed)

Engine B persists via modgunn → skade (skade = the Apache Iceberg warehouse lib, a leaf below both nornir and modgunn). modgunn owns its own world-delta tables (world_snapshots, behavior_deltas, tripwire_events) in the shared Iceberg warehouse — independent writer, same physical catalog. modgunn depends on skade only, NEVER on nornir (a nornir dep would recreate the holger↔nornir cycle modgunn exists to break). Phasing: Engine A / demo = pure leaf (no storage dep; nornir hands SCIP facts in and historizes results) → migrate to modgunn → skade when Engine B's world-delta data volume justifies owning tables. nornir stays the consumer (viz pane, tripwire feed).

Open decisions

• Repo bootstrap: extract from nornir/src/security.rs + the SCIP/knowledge modules, or greenfield with nornir as the first internal user.
• Engine A and Engine B share a repo but are separate crates/features (lean A for holger's gate; heavy B for the world-delta site).
• Advisory DB sourcing in airgap (offline OSV/CVE snapshots carried in a sealed znippy).
• Exact tripwire/anomaly algorithm set (graph diff, behavior fingerprint, statistical models).